Files
meshcore-analyzer/cmd/server/notify_source.go
T
efitenandClaude Opus 5.5 de364a8bb6 feat: mail notifications for watched nodes (user management part E) (#2140)
Part E of #2128: a logged-in user watches nodes and gets one mail when a
watched node goes offline, comes back, or reports a low battery. Admins
can add instance events: a new foreign node, and an observer going
offline or back. This covers the per-user mail part of #775.

Stacked on #2139 (part D, which builds on #2138). Review the commits
after that branch.

## The situation

A sysop learns that a repeater went silent, or that its battery is
running down, only by opening CoreScope. #775 asks for notifications.
Accounts (part A) now give a verified address to mail and a mailer with
delivery status.

## What this PR adds

**Events.** They use the instance thresholds, so a mail does not
disagree with the node page:
- `node.offline`: silent for the role's `healthThresholds` window. Last
heard comes from the packet store, and repeaters and rooms count relayed
traffic (#1598).
- `node.battery`: advert telemetry below `batteryThresholds.lowMv`,
recovered at `lowMv + 100`.
- Admins only: `foreign.new` (once per node) and `observer.offline`.

**Store.** Schema v5 with `notification_prefs`, `notification_watches`
and `notification_state`.

**Server** (only with `userManagement.notifications.enabled`)
- A notifier next to the janitor, every `intervalMinutes` (5). The
evaluator is a pure function of watches, prefs, stored states and node
snapshots.
- No burst after a restart or a new watch: a subject's first evaluation
stores its state without mailing. The loop waits for the startup load.
While ingest is stale (newest packet older than 30 minutes) the offline
checks pause, and after recovery they wait one silent window.
- One mail per user per check. Limits: 20 per user and 100 per instance
per rolling 24 hours, 50 watches per user. A change over a limit is
recorded and never mailed later.
- Every mail has a one-click unsubscribe (`List-Unsubscribe` and
`List-Unsubscribe-Post`). The GET only redirects to a confirm page, so
link scanners cannot unsubscribe anyone. Node names are cleaned of
control and bidi characters before they go into a mail.
- Routes: `GET`/`PUT /api/account/notifications`, `PUT`/`DELETE
/api/account/notifications/watches/{pubkey}`, `POST
/api/account/notifications/watch-my-nodes` (copies the synced "my nodes"
list), `GET`/`POST /api/notifications/unsubscribe`. `mailer.Message`
gains `Headers`.

**Frontend.** A "Notify me" toggle on the node pages, a Notifications
section on the account page (`#/account?section=notifications`), an
unsubscribe page, and the notification mail count on the admin overview.

Spec:
[`docs/specs/2026-10-07-node-notifications-design.md`](https://github.com/efiten/CoreScope/blob/feat/notifications/docs/specs/2026-10-07-node-notifications-design.md).

## Performance

Each check reads watches, prefs and states from `users.db` (one query
each), the watched nodes from the analyzer DB in chunks of 500, and
last-heard times from the packet store.

| Measurement | Result |
|---|---|
| One check on our staging instance, 130,000 packets in memory, 1
watcher | 6.9 ms, of which 0.93 ms holding the store read lock |
| Evaluator benchmark, 100 users with 50 watches each, 2,000 nodes |
1.75 ms |

No work is added to ingest, broadcast or any request path.

## Verification

- `internal/users` and `internal/mailer` with `-race`; the `cmd/server`
suite plus `-race` on the notifier tests; 74 new Go tests. The same
Windows-only failure as noted in #2138 applies.
- `sh test-all.sh` exits 0; the XSS gate in diff mode passes.
- User-management E2E: 26 of 26 steps locally. With notifications off
the new steps fail, so they do test the flag.
- On our staging and production instance since 7 October 2026.

## Not in this PR

- Other channels (Discord, Telegram, webhooks). Detection is separate
from delivery, so one can be added.
- The topology, RF and anomaly alerts of #775.
- If the whole server starts after a feed outage that already ended, the
grace window is unknown and a watcher can get one wrong offline mail.
The user guide says so.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 22:02:39 +02:00

206 lines
6.2 KiB
Go

package main
import (
"database/sql"
"strings"
"time"
)
// notifySource is the analyzer side the notifier reads. serverNotifySource
// is the production one; tests substitute a fake.
type notifySource interface {
ready() bool // false while the packet store is still loading after startup
health() HealthThresholds
lowBatteryMv() int
nodes(pubkeys []string, withForeign bool) (map[string]notifyNode, error)
lastHeard(pubkeys []string) (map[string]time.Time, time.Duration) // and how long the store lock was held
lastRelayed(pubkeys []string) map[string]time.Time
observers() ([]notifyObserver, error)
newestPacket() time.Time // zero when the store holds no packet
}
type serverNotifySource struct{ s *Server }
// ready needs /api/healthz readiness (best-observation pick and neighbor
// graph done) and the finished startup load: hot window and background
// fill. Readiness alone can come while the newest packets are still
// loading.
func (src serverNotifySource) ready() bool {
if readiness.Load() == 0 || src.s.store == nil {
return false
}
select {
case <-src.s.store.StartupLoadDone():
return true
default:
return false
}
}
func (src serverNotifySource) health() HealthThresholds { return src.s.cfg.GetHealthThresholds() }
func (src serverNotifySource) lowBatteryMv() int { return src.s.cfg.LowBatteryMv() }
func (src serverNotifySource) nodes(pubkeys []string, withForeign bool) (map[string]notifyNode, error) {
return src.s.db.NotifyNodes(pubkeys, withForeign)
}
func (src serverNotifySource) lastHeard(pubkeys []string) (map[string]time.Time, time.Duration) {
if src.s.store == nil {
return map[string]time.Time{}, 0
}
return src.s.store.LastHeardMap(pubkeys)
}
// lastRelayed reads the cached relay metrics (the map /api/nodes uses; the
// background recomputer refreshes it). Pass repeaters and rooms only.
func (src serverNotifySource) lastRelayed(pubkeys []string) map[string]time.Time {
if src.s.store == nil || len(pubkeys) == 0 {
return map[string]time.Time{}
}
return relayTimes(src.s.store.GetRepeaterRelayInfoMap(src.s.cfg.GetHealthThresholds().RelayActiveHours), pubkeys)
}
func (src serverNotifySource) newestPacket() time.Time {
if src.s.store == nil {
return time.Time{}
}
return src.s.store.NewestFirstSeen()
}
func (src serverNotifySource) observers() ([]notifyObserver, error) {
list, err := src.s.db.GetObservers()
if err != nil {
return nil, err
}
return notifyObserversFrom(list), nil
}
// relayTimes parses LastRelayed for the given keys; keys without a relay
// time are absent.
func relayTimes(m map[string]RepeaterRelayInfo, pubkeys []string) map[string]time.Time {
out := make(map[string]time.Time, len(pubkeys))
for _, pk := range pubkeys {
info, ok := lookupRelayInfo(m, pk)
if !ok || info.LastRelayed == "" {
continue
}
if t, ok := parseRelayTS(info.LastRelayed); ok {
out[pk] = t
}
}
return out
}
func notifyObserversFrom(list []Observer) []notifyObserver {
out := make([]notifyObserver, 0, len(list))
for _, o := range list {
n := notifyObserver{ID: o.ID}
if o.Name != nil {
n.Name = *o.Name
}
if o.LastSeen != nil {
n.LastSeen = *o.LastSeen
}
out = append(out, n)
}
return out
}
// notifyNodeChunk bounds the IN list of one query, far below SQLite's
// variable limit.
const notifyNodeChunk = 500
const notifyNodeCols = `SELECT public_key, COALESCE(name, ''), COALESCE(role, ''), COALESCE(last_seen, ''), battery_mv, COALESCE(foreign_advert, 0) FROM nodes`
// NotifyNodes reads the node rows notifications need: the given pubkeys
// (primary-key lookups, in chunks) and, with withForeign, every node with
// foreign_advert = 1 (partial index idx_nodes_foreign_advert). Keyed by
// lowercase pubkey. Read-only, on the server's mode=ro handle.
func (db *DB) NotifyNodes(pubkeys []string, withForeign bool) (map[string]notifyNode, error) {
out := make(map[string]notifyNode, len(pubkeys))
scan := func(rows *sql.Rows) error {
defer rows.Close()
for rows.Next() {
var n notifyNode
var mv sql.NullInt64
var foreign int
if err := rows.Scan(&n.Pubkey, &n.Name, &n.Role, &n.LastSeen, &mv, &foreign); err != nil {
return err
}
n.Pubkey = strings.ToLower(n.Pubkey)
if mv.Valid {
v := int(mv.Int64)
n.BatteryMv = &v
}
n.Foreign = foreign != 0
out[n.Pubkey] = n
}
return rows.Err()
}
for i := 0; i < len(pubkeys); i += notifyNodeChunk {
chunk := pubkeys[i:min(i+notifyNodeChunk, len(pubkeys))]
args := make([]any, len(chunk))
for j, pk := range chunk {
args[j] = pk
}
rows, err := db.conn.Query(notifyNodeCols+` WHERE public_key IN (`+sqlPlaceholders(len(chunk))+`)`, args...)
if err != nil {
return nil, err
}
if err := scan(rows); err != nil {
return nil, err
}
}
if withForeign {
rows, err := db.conn.Query(notifyNodeCols + ` WHERE foreign_advert = 1`)
if err != nil {
return nil, err
}
if err := scan(rows); err != nil {
return nil, err
}
}
return out, nil
}
// LastHeardMap returns, per pubkey with packets in the store, the newest
// FirstSeen among them: the node page's "Last Heard" (GetNodeHealth) in
// bulk, and how long the read lock was held (logged once per tick). One
// read lock, O(packets of the given nodes), string compares only; parsing
// happens after the lock is released.
func (s *PacketStore) LastHeardMap(pubkeys []string) (map[string]time.Time, time.Duration) {
latest := make(map[string]string, len(pubkeys))
s.mu.RLock()
locked := time.Now()
for _, pk := range pubkeys {
for _, tx := range s.byNode[pk] {
if tx != nil && tx.FirstSeen > latest[pk] {
latest[pk] = tx.FirstSeen
}
}
}
held := time.Since(locked)
s.mu.RUnlock()
out := make(map[string]time.Time, len(latest))
for pk, ts := range latest {
if t, ok := parseRelayTS(ts); ok {
out[pk] = t
}
}
return out, held
}
// NewestFirstSeen is the FirstSeen of the newest transmission in the
// store, zero when there is none or it does not parse. O(1): s.packets is
// kept sorted by FirstSeen with the newest at the tail.
func (s *PacketStore) NewestFirstSeen() time.Time {
s.mu.RLock()
var ts string
if n := len(s.packets); n > 0 && s.packets[n-1] != nil {
ts = s.packets[n-1].FirstSeen
}
s.mu.RUnlock()
t, _ := parseRelayTS(ts)
return t
}